Companies must appoint a company data protection officer in writing when 5 or more employees are employed in automated data processing.